Such an architecture is represented in FIG. 1. It comprises at least electronic devices IHMC which are essentially man-machine control interfaces and several electronic computers C. The devices are linked to the various computers by means of a first data bus FB known by the name “Field-Bus”. Hereinafter in the text, the data sent by the devices are called “events”. Once processed, the events are dispatched by the various electronic computers on a second data bus DB or “Data-Bus” so as to be taken into account by the various devices of the avionics system.
The various computers C react to the external events in two possible ways. In a first mode of operation, each computer processes the various events. The computers are independent. In a second mode of operation, each computer processes at least one event common to another computer to the benefit of one and the same defined function. There is then dependency between the computers.
In the latter case, the overall coherence of the system requires synchronization of the computers. The synchronization is both temporal and functional. The synchronization must be functional in so far as the processed events are the same. The synchronization must be temporal because the events perceived by the computers must be actually perceived in the same order so as to safeguard the integrity and the coherence of the system and because the temporal perception jitter is constrained by the overall latencies of the system.
Several solutions are possible for ensuring this synchronization. This need for integrity or synchronism in a system is often covered by a dedicated hardware solution which can be, for example, a bus redundancy and/or a common physical clock and/or control by one or more master systems. In most applications, only one of its solutions is implemented. By way of example, patent FR 2 925 191 entitled “Architecture de traitement numérique à haute intégrité à multiples ressources supervisées” [“High-integrity digital processing architecture with multiple supervised resources”] describes a digital architecture comprising two synchronized computation pathways comprising a supervision module supporting in a parametrizable manner various modes of comparison of the data of the said pathways.
In the mass-market sector, the standardized Internet protocol “NTP”, the acronym standing for “Network Time Protocol”, allows the synchronization of the clocks of several systems.
However, it remains unusual to address this need for synchronization in a system whose intrinsic technological properties do not ensure it. Moreover, the solution must address the specific constraints of the aeronautical sector, that is to say strong determinism, low latency and a low impact on the network.
A possible solution consists in having an a posteriori approach which consists in correcting the errors as they occur. One of the drawbacks of this method is that the corrections are necessarily specific since they rest upon the functional nature of the errors. Another drawback is that it is difficult to demonstrate completeness of the error cases processed. Finally, the latency in case of errors may be significant since the system potentially passes through several successive unstable states.